Information Security Self-Assessment: How to Measure ISO 27001, PDP Law, and Pentest Readiness for Free

How Far Are We From What Is Being Asked?

Most organisations start thinking about ISO 27001 or penetration testing because of an outside trigger: a tender that requires a certificate, a corporate client sending a security questionnaire, or Indonesia's Personal Data Protection (PDP) Law obligations starting to come up. The first question is almost always the same: how far are we from what is being asked?

Answering it by guesswork is expensive. Budgets come out too small because there are more gaps than expected, or too large because some controls were already running. A pentest ordered before the system is ready also tends to produce basic findings the team could have fixed on its own first.

Self-assessment is the cheapest way to get that first picture. This article explains how it works, how to read the results, and where its limits are, using the Cloudsphere Readiness Check as the example: ten free questionnaires you can complete without creating an account.

What a Readiness Self-Assessment Is

A readiness self-assessment is an evaluation you run yourself. The organisation answers a set of questions about the controls it already operates, and those answers are compared against the requirements of a standard or regulation. The result is not a pass or fail verdict. It is a map: which areas are strong, which do not exist yet, and which to tackle first.

In the Cloudsphere Readiness Check, every question is answered yes or no. The score is the percentage of yes answers, and every no carries one short recommendation that points to a concrete step, such as a clause to meet or a document to write.

Ten Questionnaires: Choose by What Triggered the Question

The questionnaires sit in four categories: compliance and governance, risk management and internal audit, cyber security maturity, and technical security testing. Choose the one that matches the question you are facing, not the one that sounds most complete.

How It Works

How to Read the Score and Readiness Level

The score is the percentage of yes answers across all questions. It then maps to one of three levels. Level names vary by questionnaire, but the thresholds are the same everywhere:

Per-Area Breakdown and Improvement Priorities

Beyond the total score, look at two other parts of the results page. The per-area breakdown shows where the score is held back: one empty mandatory clause is more urgent than several incomplete Annex A controls, even when the total score is the same.

Improvement priorities list up to six recommendations drawn from your no answers, in the questionnaire's area order. In the ISO 27001 questionnaire, mandatory clauses 4 to 10 come before Annex A controls, so the list works as a first order of work.

After the Results: Next Steps

Self-assessment results are most useful when they turn straight into a plan. These are the steps that usually make sense for each score range:

What It Costs to Go Further

The Readiness Check costs nothing, and neither does the initial consultation to discuss your results. If you decide to continue with Cloudsphere, ISO 27001 consulting ranges from IDR 25 to 40 million for a single-site organisation, from gap analysis through certification audit support. Certification body audit fees are not included; the client pays them directly to the certification body.

Penetration testing starts at IDR 15 million for a single small-scale web application, including the technical report, executive summary, and one verification retest. Final pricing for both follows the agreed scope.

What Self-Assessment Cannot Replace

Self-assessment is a starting point, not a substitute for formal evaluation. Knowing the difference keeps the results in their proper place.

Conclusion

Before you build a certification budget or order a pentest, ten minutes spent measuring where your organisation stands is almost always worth it. The results give you concrete material for discussions with management, with consultants, and with your own technical team.

Start with the questionnaire closest to your trigger: the ISO 27001 Readiness Check for certification, the PDP Law Compliance Check for personal data, or the Web Application Pentest Readiness Check before testing. If you do not know where to start, the Cyber Security Maturity Check gives a complete picture based on the NIST CSF.

To understand what comes next, read the ISO 27001 certification guide and its cost breakdown, or the penetration testing price guide for Indonesia.